CVE-2026-112866VulnerabilityPublished 10/24/2026
CVE-2026-112866: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in WPFactory Product Filter by WBW
Affects WPFactory Product Filter by WBWSource CVE Database V5
CVSS 3.1 base score
9.3Critical
- Exploitation
Not in CISA KEV, no exploitation reported
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:LWhat to do
AI-suggested
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates and consider temporary mitigations if available.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| WPFactoryProduct Filter by WBW | Affected
| Fixed in– |
Description
CVE-2026-112866 is a critical SQL Injection vulnerability in the WPFactory Product Filter by WBW plugin for WordPress. It allows an unauthenticated attacker to perform Blind SQL Injection attacks, potentially leading to high confidentiality impact and limited availability impact. The vulnerability affects versions from initial release up to 3.4.6 inclusive.